When nginx -t fails after an SSL or Varnish change, do not restart the service or edit files at random. Read the first specific error, correct the referenced path, certificate, key, include, or upstream-TLS setting, run the test again, and reload only after it succeeds. NGINX checks both configuration syntax and whether it can open files named by the configuration, so a syntactically correct file can still fail because a certificate is missing, unreadable, malformed, or attached to the wrong effective server block.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What nginx -t checks
The command performs two checks in sequence: it parses the NGINX configuration for valid syntax, then tries to open files referenced by that configuration. Those files include certificates, private keys, included configuration files, logs, and other paths used by enabled modules. The final line, often shown as configuration file ... test failed, is only the status. The useful diagnosis appears earlier.
As an Amazon Associate I earn from qualifying purchases.
Run the basic test first
sudo nginx -tCopy the complete output, not just the final line. It normally identifies a file and line number. That location is the starting point even when the actual mistake is in an included file or a server block inherited through a broader configuration.
Inspect the effective configuration with -T
sudo nginx -Tnginx -T performs the test and prints the expanded configuration, including files pulled in by include directives. Use it when the file named in your editor is not the file NGINX is actually loading, when duplicate server blocks exist, or when a certificate directive appears to be present but is not present in the effective HTTPS listener.
#1 Best Overall
Read the error path, line number, and operating context
For every failure, verify the exact path and line reported by NGINX. A relative path, a misspelled filename, an unexpected include directory, or a symlink pointing to a removed certificate can produce the same broad “configuration file test failed” message.
- Check spelling and capitalization. Linux paths are case-sensitive.
FullChain.pemandfullchain.pemare different names. - Check the include path. A wildcard include may load an old or temporary file that you did not open in your editor.
- Check readability by the NGINX master process. The private key should be restricted, but the master process must be able to read it while starting or reloading.
- Check confinement controls. Mandatory access controls or service sandboxing can deny access even when ordinary filesystem permissions look correct.
- Check the active binary and prefix. Testing one NGINX installation and reloading another can make a successful test irrelevant to the running service.
After correcting one issue, run nginx -t again. NGINX stops at the first blocking error, so a second problem may not appear until the first is fixed.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsFixing HTTPS server-block errors
An HTTPS listener needs a certificate and its matching private key in the effective server configuration. A minimal arrangement is:
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /etc/nginx/tls/fullchain.pem;
ssl_certificate_key /etc/nginx/tls/privkey.pem;
location / {
proxy_pass http://127.0.0.1:6081;
}
}“no ‘ssl_certificate’ is defined”
This means NGINX has an HTTPS listener but cannot find a certificate directive for the server configuration it is using. Confirm that the listener includes listen 443 ssl;, that ssl_certificate is inside the intended server block or an inherited context, and that the file is included in the active configuration. Use nginx -T to locate duplicate port-443 blocks and confirm which directives are effective.
Rank #2
“cannot load certificate”
Common causes are a wrong path, an unreadable file, invalid PEM data, or a certificate and private key that do not belong together. Keep the public certificate (and its chain) available to NGINX, while applying restrictive permissions to the private key. Do not make the key world-readable merely to get the test to pass; instead, correct ownership, group access, or the service’s confinement policy so the NGINX master process can read it.
Certificate-chain order
When a full chain is supplied, the server certificate must be followed by the issuing intermediate certificates in the order expected by clients. NGINX documentation warns that an incorrect chain order can prevent NGINX from starting. If a newly assembled chain causes a startup failure, rebuild the PEM file in the correct order rather than changing protocol settings to mask the problem.
Free tools Windows power users keep installed
One-click scans. No signup required.
“BIO_new_file() failed”
This error indicates that NGINX could not open a referenced file. Recheck the complete path, symlink target, parent-directory traversal permissions, and any security policy that confines the service. The file can exist and still be inaccessible if one parent directory denies traversal.
“PEM_read_bio_X509_AUX() failed”
This points to invalid certificate contents or PEM formatting. Open the file and verify that it contains the expected PEM boundaries, with no truncated copy, binary encoding, accidental quotation marks, or unrelated text. Replace the file with a freshly exported certificate chain if the boundaries or contents are damaged.
Use current TLS protocol settings
For new configurations, use modern TLS settings. Current NGINX documentation presents TLS 1.2 and TLS 1.3 as the modern baseline in recent releases. Do not copy SSLv3 or weak, obsolete cipher examples into a new server block. Protocol directives cannot repair a missing certificate, malformed PEM file, or inaccessible key; fix the file error first.
Be precise about scope: a protocol setting on one server block may not affect another block selected by the same address and port. Inspect the expanded configuration when behavior differs between hostnames.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →When NGINX connects to an HTTPS upstream
There are two separate TLS relationships in a reverse-proxy deployment:
- The client-to-NGINX connection, controlled by the public-facing certificate and the
listen 443 ssl;server block. - The NGINX-to-upstream connection, controlled by
proxy_pass, trust settings, and the upstream’s certificate.
A certificate can be valid for public clients while the second connection fails. If the origin or Varnish listener is HTTPS, use an https:// URL in proxy_pass and configure an appropriate trusted CA file and verification policy. Then inspect protocol compatibility, the server name sent for SNI, the upstream trust chain, and whether the upstream requires a client certificate.
location / {
proxy_pass https://origin.example.internal;
# Add the trusted CA and verification directives required
# by the upstream's certificate policy.
}Do not treat disabling verification as a universal fix. It may conceal a wrong hostname, an incomplete trust chain, or a compromised connection. If verification is intentionally relaxed for an internal hop, document that decision and understand that encryption without identity validation does not provide the same protection as fully verified TLS.
Choose where TLS terminates when Varnish is present
Varnish can accept HTTPS at the edge and can also use HTTPS to a backend. Decide the termination point before changing certificates; otherwise one component may be configured for TLS while the next hop still expects plain HTTP.
| Architecture | Client connection | Next hop | Operational implication |
|---|---|---|---|
| NGINX terminates TLS | Client to NGINX over HTTPS | NGINX to Varnish over HTTP or HTTPS | Keep the public certificate in NGINX and configure the proxy protocol for the Varnish listener. |
| Varnish terminates TLS | Client to Varnish over HTTPS | Varnish to NGINX or the application over HTTP or HTTPS | The certificate belongs to the Varnish edge; NGINX must not be treated as the public TLS endpoint unless traffic is deliberately sent there. |
| TLS on both hops | Client to the edge over HTTPS | Encrypted HTTPS connection between proxy layers | Each hop has its own certificate and trust requirements; a valid public certificate does not automatically validate the private upstream. |
Use one clear owner for the public certificate whenever possible. Separate certificates may still be appropriate for an encrypted internal hop, but label which certificate serves clients and which one authenticates the upstream.
Configure HTTPS from Varnish to a backend
In VCL, adding .ssl = 1; to a backend definition tells Varnish to communicate with that backend over HTTPS.
vcl 4.1;
backend default {
.host = "origin.example.internal";
.port = "443";
.ssl = 1;
}The backend certificate still has to satisfy the connection policy. Confirm that the hostname, trust chain, protocol versions, and any required client certificate match what the backend expects. A Varnish configuration can load successfully while requests later fail during the backend handshake, so test an actual request after the configuration reload.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Reload Varnish safely after certificate changes
Varnish handles TLS configuration changes through its load and commit workflow. Load the new TLS configuration, commit it, and only then reload the active configuration. Varnish documentation states that a reload error rolls changes back and that a reload cannot proceed while TLS changes remain uncommitted.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Stage the new certificate, key, and VCL or TLS configuration with the intended ownership and permissions.
- Load the new configuration through the Varnish management interface.
- Commit the TLS change before requesting the reload.
- Reload the active configuration and check the management output for errors.
- If loading or committing fails, leave the previous working configuration in place, correct the certificate or VCL, and repeat the sequence.
This rollback behavior is different from editing a file and immediately restarting a service. Preserve the known-good Varnish state until the replacement has loaded and committed successfully.
A safe NGINX–Varnish troubleshooting sequence
- Capture the failure. Run
sudo nginx -tand save all lines of output. - Expand includes when necessary. Run
sudo nginx -Tto see the complete configuration NGINX parses. - Fix the first reported path or line. Check spelling, include selection, symlinks, permissions, and confinement rules.
- Validate the HTTPS server block. Confirm
listen 443 ssl;,ssl_certificate, andssl_certificate_keyare present in the effective block. - Validate certificate material. Confirm PEM formatting, certificate-chain order, key readability, and certificate/key pairing.
- Validate the upstream scheme. Use
https://inproxy_passwhen the next hop is HTTPS, then review CA trust, verification, SNI, protocol compatibility, and client-certificate requirements. - Validate Varnish’s role. Decide whether NGINX, Varnish, or both terminate TLS and ensure each listener expects the protocol actually sent by the previous hop.
- Test again before changing runtime state. Do not reload or restart NGINX until
nginx -treports a successful test. - Reload gracefully. Reload NGINX after the successful test, then perform the Varnish load/commit/reload sequence if Varnish configuration changed.
- Verify the live path. Test the public HTTPS listener and a request that reaches the configured upstream. A successful syntax test does not prove that the runtime handshake or backend response works.
Error reference: symptom to first action
| Message or symptom | Most useful first checks |
|---|---|
no "ssl_certificate" is defined |
Inspect the effective port-443 server block with nginx -T; add or correctly inherit the certificate directive. |
cannot load certificate |
Verify the path, readability, PEM validity, chain file, and certificate/key pairing. |
BIO_new_file() failed |
Check the file path, symlink target, parent-directory permissions, and service confinement. |
PEM_read_bio_X509_AUX() failed |
Inspect PEM boundaries and contents; replace truncated or incorrectly encoded certificate data. |
configuration file ... test failed |
Ignore this as the diagnosis and fix the earlier, more specific error line. |
upstream SSL handshake failed |
Check the upstream URL scheme, TLS compatibility, SNI name, trusted CA chain, hostname validation, and client-certificate requirement. |
| Varnish TLS reload failure | Check certificate loading and commit state. A failed reload can preserve the prior configuration; correct the staged change before trying again. |
Preventing the next outage
- Keep certificate, chain, and key paths explicit and consistent across environments.
- Separate public-edge certificates from private upstream certificates in both filenames and documentation.
- Run
nginx -tas a deployment gate before every NGINX reload. - Use
nginx -Tduring reviews when includes or generated files are involved. - Test both the client-facing handshake and each encrypted upstream hop after certificate rotation.
- Use graceful reloads rather than direct restarts when the service supports them, and retain the previous Varnish configuration until the replacement is committed.
The reliable pattern is deliberate separation: first make NGINX’s complete configuration parse and open every referenced file, then validate each TLS hop, then reload components in an order that preserves a working configuration if a staged change fails.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
